Writing good review feedback

Classifying four planted issues (REV-105)

# CODE UNDER REVIEW (judge it, don't run it):
#   API_KEY = "sk-live-9f83hsd_REAL_SECRET"        # ISSUE 2
#   def apply_discount(price, pct):
#       x = price + (price * pct / 100)             # ISSUE 1 (math) + ISSUE 3 (name)
#       return x  # return the discounted price     # ISSUE 4

# The reviewer's verdict — each issue ranked by what it actually costs:
findings = {
    1: "bug",        # ADDS the discount, returns more than full price
    2: "security",   # a live key committed in source
    3: "style",      # `x` says nothing about what it holds
    4: "nit",        # the comment just restates the obvious
}
print(findings[1], findings[2], findings[3], findings[4])
# bug security style nit

Why issue 1 is a bug, not a style nit — trace it

# The planted math error actually changes the answer:
def apply_discount_buggy(price, pct):
    return price + (price * pct / 100)   # + should be -

def apply_discount(price, pct):
    return price - (price * pct / 100)

print(apply_discount_buggy(100, 20))   # 120.0  <-- charges MORE for a discount
print(apply_discount(100, 20))         # 80.0   <-- correct
# Wrong returned value = bug = blocking. Not a matter of taste.

Two security findings outrank everything else (REV-BOSS)

# A PR that hardcodes a credential AND feeds raw input into a query:
#   DB_PASSWORD = "hunter2_prod"   # committed secret
#   user_id = request.args["id"]   # TODO: validate  (flows into a query)

# Both are security — both block the merge:
verdict = {
    "password": "security",   # a hardcoded prod credential
    "todo": "security",       # unvalidated input into a query = injection risk
}
print(verdict)
# {'password': 'security', 'todo': 'security'}
# A 'TODO: validate' on input that reaches a query is not a nit — it's a hole.